Privacy Policy Addendum for Republic of Korea
This addendum to the Privacy Policy (the “Addendum”) is to address matters that are necessary to process personal information of clients and customers (“Client”) and job candidates of KKR Korea Limited Liability Corporation, KKR Capstone Korea Limited and KKR Real Assets Korea Limited Liability Corporation (each, a “KKR”) in compliance with Korean privacy laws and regulations including the Personal Information Protection Act. Please refer to the Terms of Use and Privacy Policy for more details on the conditions of using the Site.
1. PURPOSES OF PROCESSING PERSONAL INFORMATION AND ITEMS OF PERSONAL INFORMATION TO BE PROCESSED
KKR may collect some or all of Client’s and job candidates’ personal
information listed below. Among general personal information, mandatory
items to be collected from job candidates shall be collected and used
without separately obtaining consent from job candidates pursuant to
Article 15, Paragraph (1), Item 4 of the Personal Information Protection
Act (the “PIPA”):
General Personal Information
|
Purposes of Processing
Personal Information |
Items of Personal Information
to be Processed |
|
|---|---|---|
|
Mandatory
(for Clients) |
To comply with relevant laws and regulations, to conduct due diligence and background checks in order to assess the risk for anti-corruption, anti-money laundering and sanctions |
Name, photo, date of birth, residential address, occupation
(company name/position), financial status,
shareholding/control ratio, information necessary for
identification obtained from ID card (date, government
agency, etc.)
|
|
Mandatory
(for job candidates) |
Identification and confirmation of educational background and career of a candidate; management of previous application history; determination of hiring and notification thereof; confirmation of the candidate’s intention to apply; and Any other purposes reasonably related to the hiring process |
Name, surname date of birth, nationality, address, phone number (home, mobile), e-mail address; Educational background: School name, major, years of admission and graduation, graduation status, academic record; Career: Work period, workplace, position/title, duties and responsibilities, qualification and license information, history of awards/disciplinary actions, other information included in resume or cover letter; Language skills: foreign language spoken, language proficiency level. |
Unique Identification Information
|
Purposes of Processing
Personal Information |
Items of Personal Information
to be Processed |
|
|---|---|---|
|
Mandatory
(for Clients) |
To comply with relevant laws and regulations, to conduct due diligence and background checks in order to assess the risk for anti-corruption, anti-money laundering and sanctions |
Passport number, Driver’s license number |
2. RETENTION PERIOD OF PERSONAL INFORMATION
KKR may collect and use personal information as prescribed in the Privacy Policy. In principle, when the purposes of collection and use of the information are attained or the retention period is expired, KKR will destroy the information without delay. Also, if a data subject withdraws his/her consent to the collection and use of the information, or requests deletion thereof, KKR will destroy the information without delay. Notwithstanding anything to the contrary herein, if the personal information is required to be preserved under applicable laws and regulations, KKR will continuously retain the information for the period as prescribed under such laws and regulations, and use only for the purposes as prescribed under the laws and regulations.
3. THIRD-PARTY PROVISION OF PERSONAL INFORMATION
KKR provides general personal information of Clients to third parties as follows:
|
Recipient’s Name
(Contact Information |
Country of the Recipient | Items of information to be provided | Purpose for which recipient will use the information | How long recipient will retain and use the information |
|---|---|---|---|---|
| Headquarters, regional office, and affiliated companies 1 | See footnote 2 below 2 | Name, photo, date of birth, residential address, occupation (company name/position), financial status, shareholding/control ratio, information necessary for identification obtained from ID card (date, government agency, etc.) | To comply with relevant laws and regulations, to conduct due diligence and background checks in order to assess the risk for anti-corruption, anti-money laundering and sanctions | Until the recipient’s purpose of using the personal information is achieved |
In addition, KKR provides unique identification information of Clients to third parties as follows:
4. DELEGATION OF PROCESSING PERSONAL INFORMATION
KKR delegates the processing of personal information of job candidates as follows:
| Delegatee’s name | Descriptions of Delegated Work |
|---|---|
| Headquarters, regional office, and affiliated companies 5 | Review, assessment and administrative management of personal data of job applicants on behalf of KKR. |
| Greenhouse | To streamline and manage our hiring process, to track application progress and facilitate interview scheduling, feedback collection, and collaboration among hiring team, to serve other purposes reasonably related to the hiring process. |
5. OVERSEAS TRANSFER OF PERSONAL INFORMATION
KKR transfers personal information overseas as follows:
Clients:
|
Recipient’s Name
(Contact Information) |
Country of the Recipient | Items of information to be provided | Purpose for which recipient will use the information | How long recipient will retain and use the information |
|---|---|---|---|---|
| Headquarters, regional office, and affiliated companies 6 | See footnote 7 below 7 |
|
To comply with relevant laws and regulations, to conduct due diligence and background checks in order to assess the risk for anti-corruption, anti-money laundering and sanctions | Until the recipient’s purpose of using the personal information is achieved |
Job candidates:
|
Recipient’s Name
(Contact Information) |
Country of the Recipient | Items of information to be provided | Purpose for which recipient will use the information | How long recipient will retain and use the information |
|---|---|---|---|---|
| Headquarters, regional office, and affiliated companies 8 | See footnote 9 below 9 |
|
Review, assessment and administrative management of personal data of job applicants on behalf of KKR | Candidates’ data will be deleted upon completion of a search process. |
| Greenhouse | The United States of America |
|
To streamline and manage our hiring process, to track application progress and facilitate interview scheduling, feedback collection, and collaboration among hiring team, to serve other purposes reasonably related to the hiring process. | Candidates’ data will be deleted upon completion of a search process. |
Personal information set forth above may be transferred overseas from time to time as necessary via information and communications network. A Client or job applicant who wishes to refuse a transfer of personal information overseas may contact our Chief Privacy Officer, Jackson Yeh, at jackson.yeh@kkr.com to communicate such request. Please note, however, that we may no longer be able to execute or maintain an employment agreement or other contractual relationship with such Client or job applicant as a result of such refusal.
6. DESTRUCTION OF PERSONAL INFORMATION
KKR will destroy personal information without delay when the information becomes unnecessary, upon, including, without limitation, the expiration of the retention period set forth above or attainment of the purposes of processing consented to by the relevant data subject. However, if the information is required to be preserved under other laws and regulations notwithstanding that the retention period consented by the data subject is expired or the purposes of processing personal information are attained, such information will be transferred to a separate database or storage place. KKR will permanently destroy any personal information recorded and/or saved in electronic format by using a means that can ensure that it cannot be restored and recovered. Personal information printed on paper will be destroyed by shredding or incineration thereof.
7. PROCESSING OF PERSONAL INFORMATION FOR PURPOSES WITHIN SCOPE REASONABLY RELATED TO ORIGINAL PURPOSE OF COLLECTION
In accordance with the PIPA, KKR may use or provide personal information within the scope reasonably related to the original purpose of the collection, in consideration of whether such processing results in any disadvantages to data subjects, whether necessary measures have been taken to ensure safety of personal information, etc.
The KKR will determine with due care whether to use and/or provide
personal information (i) in consideration of general circumstances
including relevant laws and regulations such as the PIPA, purpose of use
or provision of personal information, methods of use and provision of
personal information, items of personal information to be used or
provided, matters to which data subjects provided consent or which were
notified/disclosed to data subjects, impact on data subjects upon the
use or provision, and measures taken to protect subject information and
(ii) after considering the following factors:
- Whether the additional use/provision is related to the original purpose of the collection;
- Whether the additional use/provision is foreseeable in light of the circumstances under which personal information was collected and practices regarding processing;
- Whether the additional use/provision unfairly infringe on the interests of the data subject; and
- Whether the necessary security measures such as pseudonymization or encryption were taken.
8. RIGHTS OF DATA SUBJECTS AND METHODS TO EXERCISE SUCH RIGHTS
A data subject may exercise the following privacy rights against KKR at any time:
- Right to demand access to his or her personal information;
- Right to demand correction in case of error, etc.;
- Right to demand deletion of his or her personal information; and
- Right to demand suspension of personal information processing.
A data subject may exercise the above rights in writing or via email, fax, etc. and KKR will take appropriate measures without delay.
In the event that a data subject requests correction or deletion of all or a certain portion of personal information, the relevant information will not be used or provided until the correction or deletion is completed.
A data subject may exercise such rights through his or her legitimate
representative or agent authorized by the data subject, in which case,
the appropriate power of attorney must be submitted to KKR.
9. MEASURES TO ENSURE THE SECURITY OF PERSONAL INFORMATION
1. Managerial Measures
- KKR appointed a Chief Privacy Officer (“CPO for Korea”) to ensure that data subjects' personal information is processed in conformity with Korean privacy laws. KKR has established and implemented an internal management plan to this end.
2. Technical Measures
- KKR controls access to personal information, and will restrict and manage the access right.
- KKR records the details of Client and job candidates with access rights to personal information, and will retain such records for a certain period of time.
- KKR implements safety measures (including access control function) to prevent any unauthorized access to personal information. In addition, safe access measures, including a virtual private network, will be utilized to control the access from the outside.
- KKR establishes and applies password generation rules to enable Client to set up and use a secure password. Upon designating a password to access information processing system, Client is obligated to keep the password confidential and must not disclose it to a third party.
- KKR installs and periodically updates programs to fix security defects in software, including operating systems.
3. Physical Measures
-
KKR takes physical access prevention measures, including
restrictions on access and placing locks, to store personal
information kept by way of hard copy in a safe manner.
10. CHIEF PRIVACY OFFICER
KKR appointed the following person as the CPO for Korea to process personal information and handle complaints regarding processing personal information. A data subject may file any complaints relating to protection of personal information with the CPO for Korea at the following contact details:
Name – Jackson Yeh
Contact Information – Email: jackson.yeh@kkr.com
11. AMENDMENTS TO THIS PRIVACY POLICY
In the event that KKR makes any amendment to this Privacy Policy, the contents and effective date of such amendments will be informed to Client and job candidates in a timely manner according to the relevant laws and regulations such as the Personal Information Protection Act, etc.
Established on February 26, 2025
1 For a list of affiliates of KKR, please refer to our SEC filing of Form 10-K; the form for the year ended December 31, 2023 is available at: https://www.sec.gov/Archives/edgar/data/1404912/000140491224000005/kkr-20231231xex211subsidia.htm (Exhibit 21.1).
2 For a list of office locations, please visit https://www.kkrvip.net/our-firm/locations .
3 For a list of affiliates of KKR, please refer to our SEC filing of Form 10-K; the form for the year ended December 31, 2023 is available at: https://www.sec.gov/Archives/edgar/data/1404912/000140491224000005/kkr-20231231xex211subsidia.htm (Exhibit 21.1).
4 For a list of office locations, please visit https://www.kkrvip.net/our-firm/locations .
5 For a list of affiliates of KKR, please refer to our SEC filing of Form 10-K; the form for the year ended December 31, 2023 is available at: https://www.sec.gov/Archives/edgar/data/1404912/000140491224000005/kkr-20231231xex211subsidia.htm (Exhibit 21.1).
6 For a list of affiliates of KKR, please refer to our SEC filing of Form 10-K; the form for the year ended December 31, 2023 is available at: https://www.sec.gov/Archives/edgar/data/1404912/000140491224000005/kkr-20231231xex211subsidia.htm (Exhibit 21.1).
7 For a list of office locations, please visit https://www.kkrvip.net/our-firm/locations .
8 For a list of affiliates of KKR, please refer to our SEC filing of Form 10-K; the form for the year ended December 31, 2023 is available at: https://www.sec.gov/Archives/edgar/data/1404912/000140491224000005/kkr-20231231xex211subsidia.htm (Exhibit 21.1).
9 For a list of office locations, please visit https://www.kkrvip.net/our-firm/locations .